OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 3
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.
Its weaknesses: 39
CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125
- 7.8CVE-2026-58836EPSS 0.1%
In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error…
- 8.4CVE-2026-55287EPSS 0.10%
In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional e…
- 8.4CVE-2026-55263EPSS 0.08%
In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution pr…
- 8.4CVE-2026-55257EPSS 0.10%
In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not nee…
- 8.4CVE-2026-49923EPSS 0.1%
In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio…
- 4.0CVE-2026-49912EPSS 0.1%
In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges n…
- 8.4CVE-2026-45514EPSS 0.1%
In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User i…
- 6.8CVE-2026-28645EPSS 0.1%
In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges neede…
- 4.0CVE-2026-28632EPSS 0.1%
In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed …
- 8.4CVE-2025-26433EPSS 0.1%
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio…
- 8.4CVE-2025-22436EPSS 0.08%
In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…
- 9.5CVE-2026-105606EPSS 0.4%
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Jo…
- 9.4CVE-2026-105603EPSS 0.3%
Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.
- 9.3CVE-2026-105769EPSS 0.2%
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-crede…
- –CVE-2026-113687EPSS 0.2%
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing …
- –CVE-2026-110535EPSS 0.3%
Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, fro…
- –CVE-2026-109083EPSS 0.2%
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process contain…
- 9.1CVE-2026-120213EPSS 0.7%
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to…
- 5.9CVE-2026-101182EPSS 0.07%
Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.
- 4.8CVE-2024-5617EPSS 0.2%
The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to t…
- 6.3CVE-2026-120309EPSS 0.2%
Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded que…
- 2.3CVE-2026-87718EPSS 0.3%
Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when de…
- 10.0CVE-2026-120338EPSS 0.8%
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 …
- 9.9CVE-2026-120306EPSS 0.4%
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the s…
- 8.6CVE-2026-120224EPSS 0.4%
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be l…
- 5.1CVE-2026-120185EPSS 0.2%
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improp…
- 7.1CVE-2026-120202EPSS 0.3%
Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers…
- 8.8CVE-2026-76010EPSS 0.8%
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assig…
- 4.3CVE-2026-109231EPSS 0.4%
The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is respons…
- 9.8CVE-2026-118235EPSS 0.7%
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to m…
- 8.6CVE-2026-114217EPSS 0.09%
A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can…
- 8.8CVE-2026-120070EPSS 0.3%
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via…
- 9.8CVE-2026-116512EPSS 0.6%
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. Thi…
- 8.8CVE-2026-104012EPSS 0.3%
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-bo…
- 7.5CVE-2026-120040EPSS 0.3%
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-le…
- 3.7CVE-2026-118437EPSS 0.2%
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
- 4.2CVE-2026-110808EPSS 0.2%
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above …
- 6.9CVE-2026-63399EPSS 0.3%
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to …
- 8.8CVE-2026-63339EPSS 0.3%
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions…
- 6.9CVE-2026-55614EPSS 0.4%
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-co…
- 6.9CVE-2026-55613EPSS 0.4%
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a J…
- 3.7CVE-2026-55612EPSS 0.3%
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` wi…
- 8.8CVE-2026-16760EPSS 0.5%
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAF…
- 8.7CVE-2026-62990EPSS 0.2%
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the adminis…
- 6.8CVE-2026-119343EPSS 0.3%
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without…
- 9.3CVE-2026-61850EPSS 0.4%
Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project's…
- 5.1CVE-2026-119730EPSS 0.2%
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indic…
- 6.5CVE-2026-119328EPSS 0.4%
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values int…
- 7.1CVE-2026-116252EPSS 0.3%
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the h…
- 7.2CVE-2026-116249EPSS 0.2%
In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_file_path() only stripped leading slashes before joining the two.…